Wed Mar 9 18:04:17 2016 UTC ()
Update to 4.1.1.
This is a security release addressing CVE-2016-2851.
- Fix an integer overflow bug that can cause a heap buffer overflow (and
from there remote code execution) on 64-bit platforms
- Fix possible free() of an uninitialized pointer
- Be stricter about parsing v3 fragments
- Add a testsuite ("make check" to run it), but only on Linux for now,
since it uses Linux-specific features such as epoll
- Fix a memory leak when reading a malformed instance tag file
- Protocol documentation clarifications
(gdt)
diff -r1.17 -r1.18 pkgsrc/chat/libotr/Makefile
diff -r1.11 -r1.12 pkgsrc/chat/libotr/distinfo
--- pkgsrc/chat/libotr/Makefile 2014/10/21 11:46:31 1.17
+++ pkgsrc/chat/libotr/Makefile 2016/03/09 18:04:17 1.18
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.17 2014/10/21 11:46:31 gdt Exp $
+# $NetBSD: Makefile,v 1.18 2016/03/09 18:04:17 gdt Exp $
-VERSION= 4.1.0
+VERSION= 4.1.1
DISTNAME= libotr-${VERSION}
PKGNAME= libotr-${VERSION}
CATEGORIES= chat security
--- pkgsrc/chat/libotr/distinfo 2015/11/03 01:20:21 1.11
+++ pkgsrc/chat/libotr/distinfo 2016/03/09 18:04:17 1.12
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.11 2015/11/03 01:20:21 agc Exp $
+$NetBSD: distinfo,v 1.12 2016/03/09 18:04:17 gdt Exp $
-SHA1 (libotr-4.1.0.tar.gz) = df30bc87a7a8f37678dd679d17fa1f9638ea247e
+SHA1 (libotr-4.1.1.tar.gz) = 3894b82a6c307ad011681ad342d69b18344933ae
-RMD160 (libotr-4.1.0.tar.gz) = addbde1d9b4f423025ee14481961c580fbe6b9e6
+RMD160 (libotr-4.1.1.tar.gz) = 528c5ad4ba89f3225bebf5b5ecadf815239fed88
-SHA512 (libotr-4.1.0.tar.gz) = 3c6a6bf8ee64467484519187d1bc86001d5ae6ceb169e9c828f7750a1db3dadfef677b828a5d292e5caa12f874711df4fd2db977d48dc968e9f0edc2eab58e3e
+SHA512 (libotr-4.1.1.tar.gz) = c957206235b9f627542f23a645c822ea1b318d83fa655f41ed8d9a3c0dddf30b88f0ca82060026af155e48ecb13969dc9270831f20304669794151f666ae5cb0
-Size (libotr-4.1.0.tar.gz) = 576771 bytes
+Size (libotr-4.1.1.tar.gz) = 655791 bytes